Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: SMS-based two-factor authentication is not secure

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 291 posts

Re: Tell HN: SMS-based two-factor authentication is not secure

#31

Post by j45 »

jsnell wrote: post #2

Your problem is not with SMS as a second factor though. (Unless you think the attacker had your password as well). It is with the use of SMS as a single recovery factor. The very things that make SMS a uniquely good second factor make it an awful only factor. Use of SMS for account recovery should in general (or at least for important accounts) have a delay (order of days) that allows the real user to intervene.

SMS will remain vulnerable as long as the mobile accounts that hold them upstream remain vulnerable.

One option I’ve heard might be different is to not your your mobile sms on accounts, but to get a voip based sms number. It might leave things at the mercy of a different system but the footprint might be different.

Re: Tell HN: SMS-based two-factor authentication is not secure

#32

Post by inetknght »

I lost my Microsoft account years ago. I still get emails from Microsoft stating that there's suspicious activity on the account. I got two just yesterday.

Despite that, despite still having access to the email the account is on, I cannot recover the Microsoft account. Despite Microsoft notifying me that the account is still, years later to this day, being abused, cannot use any form of recovery. I cannot access the account with help from support or even after visiting a brick-and-mortar store.

It's one big reason that I've long since refused to purchase anything more from Microsoft and have ditched Windows.

Good luck recovering your stuff.

Re: Tell HN: SMS-based two-factor authentication is not secure

#33

Post by ncphil »

chris_st wrote: post #13

Got an email from Heroku last night saying they're discontinuing SMS as a 2FA scheme... yay Heroku!

Yep. They've been planning that for awhile, hopefully a case of "leading by example". For me hardware keys (U2F) with TOTP as a backup are really essential. I've purged SMS where I can. Unfortunately, too many (like banks) have stopped at SMS and email as options -- and that only recently. My (insert name of wildly popular open source password manager here) vault is secured by U2F with TOTP as a fallback, and I use its TOTP feature to secure logins for less sensitive services. Someone mentioned building in delays for resets: that's actually how both the US IRS and Social Security roll. Last time I reset SSA I had to wait for a physical letter with further instructions. Inconvenient, but probably a step in the right direction. If government intel agencies weren't so uptight about crypto, we could all have our own officially issued crypto keys by now. But no. The prols can't be trusted -- and don't deserve it anyway.

Re: Tell HN: SMS-based two-factor authentication is not secure

#34

Post by darkwater »

staticassertion wrote: post #26
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's su…

> In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes.

Which have either higher costs or "administrative burden" or both which will lead them to failure for a big chunk of non tech-savvy people. Educating a casual user that they need to print out recovery codes and store them in a safe place it's not exactly top notch usability.

Re: Tell HN: SMS-based two-factor authentication is not secure

#35

Post by jsnell »

staticassertion wrote: post #26
Wowfunhappy wrote: post #22

Earlier quoted context omitted.

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's su…

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security.

There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch.

For most of the world, SMS is it. The Nordic countries have the bank if system. But the market is too small. Hopefully the EU-wide identity verification systems solve the scale problem.

Re: Tell HN: SMS-based two-factor authentication is not secure

#36

Post by ccn0p »

meowster wrote: post #9

I think crypto companies should block withdraws for a period of time after a password recovery. (OP, you are calculating your losses, but didn't specify what those losses were. Did the theif get your crypto?)

i thought coinbase did just this.... either made recoveries a multi-day thing, or disallowed transfers afterwards. maybe that was blockfi.

Re: Tell HN: SMS-based two-factor authentication is not secure

#37

Post by staticassertion »

Wowfunhappy wrote: post #29
staticassertion wrote: post #26

Earlier quoted context omitted.

> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's su…

> the fact that it can actually reduce your security is very problematic. The only way it can ever actively reduce your security is if it's used as a single factor, as it was for the OP.

> The only way it can ever actively reduce your security is if it's used as a single factor, as it was for the OP.

I don't believe this is true. If I have your SMS I am considerably more likely to be able to phish a recovery, even if recovery also involves something else. Every piece of information the attacker can get is valuable for forging auth.

What SMS is good at is being available. At this point cell phones are distributed to a massive portion of the world. But at this point smartphones can also act as U2F devices, I believe, so I'm not sure that benefit is so meaningful anymore.

Instead of companies wasting time on SMS 2FA they should be figuring out how to help their customers set up U2F.

I'd like to avoid being in a situation in 10 years where we have great options for end users available but 2FA SMS is still supported for legacy reasons, and unwitting users end up using it because it seems easier and they don't understand the risks.

Re: Tell HN: SMS-based two-factor authentication is not secure

#38

Post by Zolt »

ThePowerOfFuet wrote: post #25
Zolt wrote: post #21

Earlier quoted context omitted.

I have not regained access to my bitcoin account, in part because I have not contacted customer support to do so. I’ve been too busy regaining access and continuing to support my client base. My account is locked, and I am pretty sure my funds are still there. It will be a significant loss, but not devastating as this was my non-primary investment account. I still don’t know the full extent of my losses. So far, my l…

If your crypto was stored on an exchange then this is par for the course; rule number one is that if you don't control the private keys, the coins are not yours. You haven't even tried to regain access to it? Instead of spending time on HN you might want to reach out to Coinbase.

Agreed. Done. "Thanks for taking the time to contact us. We're currently receiving a high number of requests so we may take longer to respond, but our team is working hard to get to every inquiry quickly."

Re: Tell HN: SMS-based two-factor authentication is not secure

#39

Post by staticassertion »

jsnell wrote: post #35
staticassertion wrote: post #26

Earlier quoted context omitted.

> Yeah, and it requires me to use a U2F token, which I can loose, etc. In which case there are much safer recovery mechanisms available. For example, a second U2F token, or handwritten backup codes. > and SMS as a second factor seems like a perfectly reasonable balance. My point is that it isn't. Unfortunately, today, identity is a true privilege - it pretty much requires purchasing multiple U2F tokens, and that's su…

But that is my entire point. SMS as a second factor is purely additive. It cannot reduce security. There is pretty much no form of second factor that users are worse at passing than backup codes. Even if people print them out (few do), they won't find them when the emergency happens. You need some form of trust that can be bootstrapped again from scratch. For most of the world, SMS is it. The Nordic countries have th…

> SMS as a second factor is purely additive. It cannot reduce security.

I responded to this in another post.

> There is pretty much no form of second factor that users are worse at passing than backup codes.

Agreed, I also mentioned backup U2F. At this point modern smart phones package TPMs that can also do attestation, so we're really not too far away from being in a situation where the vast majority of people have a U2F token in their pocket.

Re: Tell HN: SMS-based two-factor authentication is not secure

#40

Post by rocqua »

Wowfunhappy wrote: post #22
staticassertion wrote: post #12

Earlier quoted context omitted.

If the argument is "but you still have a password" it really kind of shows how weak SMS 2FA is. Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe - it is itself just a strong auth mechanism, whereas SMS is adding extremely questionable value between the ability to phish SMS 2FAs or hijack the number. Even in a situation where the attacker would have neede…

> Compare that to a U2F token where you can very reasonably remove the password entirely and still be just as safe Yeah, and it requires me to use a U2F token, which I can loose, etc. You have to balance security and usability, and SMS as a second factor seems like a perfectly reasonable balance.

Its generally not "second factor authentication" but 2-factor authentication. The idea is that you have 2 separate authentication factors. Preferably both with decent security.

Besides, I don't believe coinbase does SMS only account recovery. So here SMS really did fail as a second factor. Since it seems attackers must have had a password and SMS. (I am not 100% on the coinbase account recovery process)

Post reply on HN